SFTP chroot() jail howto for Linux hosts.

In modern versions of OpenSSH (https://openssh.org), the sshd configuration 
(typically in /etc/ssh/sshd_config) supports chroot() jails through a
"ChrootDirectory" directive.

This is useful to force users to a specific directory, so they do not have
access to the entire filesystem of the host running sshd.

Both sftp and interactive ssh (shell) logins are supported in this manner.

NOTE: For interactive ssh (shell) logins, a number of device nodes are needed to 
make this work, and these are described in the man page of sshd_config(5). This
howto does NOT cover this use case.

The following configuration is required:

1. a defined (set of) sftp-only user(s) 
2. a configuration in /etc/ssh/sshd_config that handles chroot() jails for these
   users.
3. properly configured home directories for these sftp-only users

Start by creating your user(s), e.g. by running groupadd(8) and useradd(8). The
example below shows the creation of one user ("myuser") belonging to the "sftpuser"
group that cannot login with a password ("!" in shadow file on creation):

# groupadd sftpuser
# useradd -g sftpuser -s /usr/bin/nologin -d /home/myuser myuser
# mkdir /home/myuser
# chown root:root /home/myuser
# mkdir /home/myuser/.ssh
# mkdir /home/myuser/writable
# chown myuser:sftpuser /home/myuser/writable
# chown 755 /home/myuser/writable

Add the following to /etc/ssh/sshd_config:

Match Group sftpuser
    PasswordAuthentication no
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTCPForwarding no
    X11Forwarding no

Restart the sshd daemon:

# systemctl restart sshd

Obtain the user's ssh public keys and place them in the respective user's 
.ssh/authorized_keys file. Note that this directory and file, too, must be owned
by root:

# chown -R root:root /home/myuser/.ssh
# chmod 644 /home/myuser/.ssh/authorized_keys

Each sftp-only user is now forced to use key-based authentication, as well as only 
being able to upload/create files and directories in their "writable" directory.